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Method and System To Provide A Trusted Channel Within A Computer System 

For A SIM Device 

5 Field of Invention 

[0001] The field of invention relates generally to trusted computer platforms; and, 
more specifically, to a method and apparatus to provide a trusted channel within a 
computer system for a SIM device. 

10 Background 

[0002] Trusted operating systems (OS) and platforms are a relatively new concept. In 
first generation platforms, a trusted environment is created where applications can run 
trustedly and tamper-free. The security is created through changes in the processor, 
chipset, and software to create an environment that cannot be seen by other 
15 applications (memory regions are protected) and cannot be tampered with (code 

execution flow cannot be altered). As a result, the computer system cannot be illegally 
accessed by anyone or compromised by viruses. 

[0003] In today's computing age, Subscripber Identify Modules (SIM), sometimes 
20 referred to as a smart card, are becoming more prevalent. A SIM is a credit card sized 
card that is typically used for Global System for Mobile communications (GSM) phones 
to store telephone account information and provide Authentication, Authorization and 
Accounting (AAA). The SIM cards also allow a user to use a borrowed or rented GSM 
phone as if it were their own. SIM cards can also be programmed to display custom 
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menus on the phone's readout. In some cases, the SIM cards include a built-in 
microprocessor and memory that may be used in some cases for identification or 
financial transactions. When inserted into a reader, the SIM is accessible to transfer 
data to and from the SIM. SIM cards may also be inserted into 

[0004] When using a SIM card in a computer system, there is a need to securely access 
information from the SIM card in order to prevent accesses to the SIM from 
unauthorized software applications. Such accesses may be intended to learn certain 
SIM secrets or to break GSM authentication mechanisms and steal services provided 
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Figures 

[0005] One or more embodiments are illustrated by way of example, and not 
limitation, in the Figures of the accompanying drawings, in which 
[0006] Figure 1 illustrates a computer system capable of providing a trusted platform 
5 to protect selected applications and data from unauthorized access, according to one 
embodiment; and 

[0007] Figure 2 is a flow diagram describing a process of providing a trusted 
channel within a computer system for a SIM device, according to one embodiment. 
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Detailed Description 

[0008] A method and system to provide a trusted channel within a computer system 
for a SIM device is described. In one embodiment, data is exchanged between an 
application being executed in a trusted platform and a SIM device, wherein the data 
exchanged is protected from unauthorized access. In one embodiment, an encryption 
key is exchanged via a trusted channel within a computer system. Data encrypted with 
the encryption key is exchanged via an untrusted channel within the computer system. 

[0009]ln the following description, numerous specific details are set forth. However, it is 
understood that embodiments may be practiced without these specific details. In other 
5 instances, well-known circuits, structures and techniques have not been shown in detail 
in order not to obscure the understanding of this description. 

[0010] Reference throughout this specification to "one embodiment" or "an embodiment" 
indicate that a particular feature, structure, or characteristic described in connection with 

10 the embodiment is included in at least one embodiment. Thus, the appearances of the 
phrases "in one embodiment" or "in an embodiment" in various places throughout this 
specification are not necessarily all referring to the same embodiment. Furthermore, 
the particular features, structures, or characteristics may be combined in any suitable 
manner in one or more embodiments. In addition, as described herein, a trusted 

15 platform, components, units, or subunits thereof, are interchangeably referenced as a 
protected or secured. 
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Trusted Platform 

[0011] Fig. 1 illustrates a computer system, according to one embodiment, capable of 
providing a trusted platform to protect selected applications and data from unauthorized 
access. System 100 of the illustrated embodiment includes a processors 1 10, a chipset 
5 120 connected to processors 1 10 via processor bus 130, a memory 140, and a SIM 
device 180 to access data on a SIM card 182. In alternative embodiments, additional 
processors and units may be included. 

[0012] Processor 110 may have various elements, which may include but are not limited. 
10 to, embedded key 116, page table (PT) registers 114 and cache memory (cache) 112. 
All or part of cache 112 may include, or be convertible to, private memory (PM) 160. 
Private memory is a memory with sufficient protections to prevent access to it by any 
unauthorized device (e.g., any device other than the associated processor 110) while 
activated as a private memory. 

15 

[0013] Key 116 may be an embedded key to be used for encryption, decryption, 
and/or validation of various blocks of data and/or code. Alternatively, the key 116 may 
be provided on an alternative unit within system 100. PT registers 1 14 may be a table 
in the form of registers to identify which memory pages are to be accessible only by 
20 trusted code and which memory pages are not to be so protected. 



[0014] In one embodiment, the memory 140 may include system memory for system 
100, and in one embodiment may be implemented as volatile memory commonly 
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referred to as random access memory (RAM). In one embodiment, the memory 140 
may contain a protected memory table 142, which defines which memory blocks (where 
a memory block is a range of contiguously addressable memory locations) in memory 
140 are to be inaccessible to direct memory access (DMA) transfers. Since all 
5 accesses to memory 140 go through chipset 120, chipset 120 may check protected 
memory table 142 before permitting any DMA transfer to take place. In a particular 
operation, the memory blocks protected from DMA transfers by protected memory table 
142 may be the same memory blocks restricted to protected processing by PT registers 
144 in processor 110. The protected memory table 142 may alternatively be stored in a 
10 memory device of an alternative unit within system 100. 

[001 5] In one embodiment, Memory 140 also includes trusted software (S/W) monitor 
144, which may monitor and control the overall trusted operating environment once the 
trusted operating environment has been established. In one embodiment, the trusted 
15 S/W monitor 144 may be located in memory blocks that are protected from DMA 
transfers by the protected memory table 142. 

[0016] Chipset 120 may be a logic circuit to provide an interface between 
processors 110, memory 140, SIM device *\80 ± and other devices not shown. In one 
20 embodiment, chipset 120 is implemented as one or more individual integrated circuits, 
but in other embodiments, chipset 120 may be implemented as a portion of a larger 
integrated circuit. Chipset 120 may include memory controller 122 to control accesses 



42.P1 8073 



to memory 140. In addition, in one embodiment, the chipset 120 may have a SIM 
reader of the SIM device integrated on the chipset 120. 

[0017]ln one embodiment, protected registers 126 are writable only by commands that 
5 may only be initiated by trusted microcode in processors 110. Trusted microcode is 
microcode whose execution may only be initiated by authorized instruction(s) and/or by 
hardware that is not controllable by unauthorized devices. In one embodiment, trusted 
registers 126 hold data that identifies the locations of, and/or controls access to, trusted 
memory table 142 and trusted S/W monitor 144. In one embodiment, trusted registers 
10 126 include a register to enable or disable the use of trusted memory table 142 so that 
the DMA protections may be activated before entering a trusted operating environment 
and deactivated after leaving the trusted operating environment. 

Trusted Channel with SIM Device 

15 

[0018] Fig. 2 is a flow diagram describing a process of providing a trusted channel 
within a computer system for a SIM device, according to one embodiment. As 
described herein, reference to a SIM device includes other types of related Smart cards. 
The processes described in the flow diagram of Fig. 2, are described with reference to 
20 the system of Fig. 1 , described above. 

[0019]ln one embodiment, in process 202, an application 150 being executed in a 
trusted environment of the system 100, determines information is to be accessed from a 
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SIM device 180 of the system 100. The application 150 being executed in a trusted 
atmosphere can be located in a protected memory, such as protected memory 160 of 
cache 1 12, or a protected section of memory 140. In one embodiment, the SIM device 
180 includes a mechanism to ascertain that the accesses are coming from the 
5 application in a trusted environment that is running on the same platform that the SIM 
device is physically attached to, and not from some remotely executing application. 

[0020] In process 204, the application and the SIM device perform a mutual 
authentication to determine that the SIM device is the correct device from which the 
10 application is to receive data, or that the application is the correct application to which 
the SIM device is to send the data. The mutual authentication may be conducted via a 
variety of processes known throughout the concerned field of technology. 

[0021] In process 206, following the completion of the mutual authentication, in one 
15 embodiment, the application 150 transmits an encryption key to a protected section of 
memory 140, via a trusted channel with the memory device, and corresponding PT 
entries held in the CPU. In one embodiment, the protected section of memory to store 
the encryption key is identifiable via the protected memory table 142. 

20 [0022] The encryption key provided by the application 150 to the protected section of 
memory 140, is generated by the application 150, and is applicable to one of several 
available encryption processes, such as the Data Encryption Standard (DAS) or the 
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Advanced Encryption Standard (AES). In one embodiment, the encryption key is 
generated via utilization of the key 1 16 of processor 110. 

[0023] In process 208, the SIM device 180 accesses the encryption key from the 
5 protected section of memory 140. In one embodiment, the SIM device accesses the 
encryption key via a trusted port 1 12, of a chipset 120, which is mapped to the protected 
section of memory 140. In one embodiment, the trusted port may support one several 
platform bus protocols, including USB. In an alternative embodiment, the encryption 
key is provided by the SIM device, wherein the application accesses the encryption key 
10 from the SIM device via the trusted port of the chipset. 

[0024] In process 210, the SIM device 180 uses the encryption key to encrypt data to be 
sent to the application 150. In process 212, the encrypted packets are transferred from 
the SIM device 180 by a host controller 128 (e.g., a USB host controller) of the chipset 
15 to a regular area of memory (i.e., unprotected section of memory 148). For example, an 
area of memory that is used to store data packets, such as USB data packets. 

[0025] In one embodiment, the encrypted packets are transmitted to the memory by the 
host controller via a regular port 120 of the chipset (i.e., an unprotected port), which 
20 maps to an unprotected section of memory 148. In one embodiment, the encrypted 
* packets from the SIM device include Message Authentication Code (MAC) to provide a 
level of integrity protection. 
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[0026] In process 214, a driver (e.g., an unprotected USB driver) accesses the 
encrypted packets from the unprotected section of memory 148 and provides the 
encrypted packets to the application 150 being executed in the trusted environment. In 
process 216, the application 150 decrypts the encrypted packets to access the data 
5 from the SIM device, which have been securely transferred to the application via an 
untrusted path within the system 100. 

[0027] In one embodiment, new encryption keys may be exchanged based on 
predetermined events. For example, a new encryption key may be exchanged following 
10 one of, or a combination of, each new transaction (as defined based on implementation 
choice), the passage of a predetermined period of time, or the exchange of a 
predetermined amount of data. 

[0028] In another alternative embodiment, multiple encryption keys are exchanged 
15 between the application 150 and the SIM device 180, to be used encrypted data 

exchanges between the SIM device 180 and the application 150. For example, a SIM 
device may include multiple data pipes (e.g., bulk-in, bulk-out, and default control 
pipes). For each of the data pipes of the SIM device, a separate encryption key may be 
used to protect the data exchanges. Alternatively, the separate data pipes may all use 
20 the same encryption key. 



[0029] In an alternative embodiment, the data packets may be transmitted from the SIM 
device to the application without the use of encryption. For example, the host controller 
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128 transmits the data from the SIM device to the protected section of memory 140 via 
the trusted port 112 of the chipset 120. A trusted driver would then access the data 
from the protected section of memory 140 and provide the data to the application 150 
via a trusted path, without having the SIM data encrypted. 

[0030]The processes described above can be stored in the memory of a computer 
system as a set of instructions to be executed. In addition, the instructions to perform 
the processes described above could alternatively be stored on other forms of machine- 
readable media, including magnetic and optical disks. For example, the processes 
described could be stored on machine-readable media, such as magnetic disks or 
optical disks, which are accessible via a disk drive (or computer-readable medium 
drive). Further, the instructions can be downloaded into a computing device over a data 
network in a form of compiled and linked version. 

15 [0031]Alternatively, the logic to perform the processes as discussed above could be 
implemented in additional computer and/or machine readable media, such as discrete 
hardware components as large-scale integrated circuits (LSI's), application-specific 
integrated circuits (ASIC's), firmware such as electrically erasable programmable read- 
only memory (EEPROM's); and electrical, optical, acoustical and other forms of 

20 propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.); etc. 

[0032] In the foregoing specification, the invention has been described with reference 
to specific exemplary embodiments thereof. It will, however, be evident that various 
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modifications and changes may be made thereto without departing from the broader 
spirit and scope of the invention as set forth in the appended claims. In particular, as 
described herein, the SIM device is inclusive of Smart card devices, including USB 
Chip/Smart Card Interface Devices (CCID. Furthermore, the architecture of the system 
as described herein is independent of any particular key exchange protocols that are 
used. The specification and drawings are, accordingly, to be regarded in an illustrative 
rather than a restrictive sense. 
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